commit 276556dbd2d9f56f8933393f927e88fae142ce8f
author Dan Carpenter <error27@gmail.com> Fri Jul 08 10:21:15 2011 +0300
committer John W. Linville <linville@tuxdriver.com> Tue Jul 26 16:27:24 2011 -0400
tree f5764c864cde2688b76792647489fa6ba59056a9
parent 6e6e8c510a84fe3237ef02b954e58cca6a3f4b1a

NFC: pn533: use after free in pn533_disconnect()

We freed "dev" on the line before.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/nfc/pn533.c

diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index 0372315..c77e054 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -1596,7 +1596,7 @@
 	usb_free_urb(dev->out_urb);
 	kfree(dev);
 
-	nfc_dev_info(&dev->interface->dev, "NXP PN533 NFC device disconnected");
+	nfc_dev_info(&interface->dev, "NXP PN533 NFC device disconnected");
 }
 
 static struct usb_driver pn533_driver = {